Quadratic relation of S-box and its application to the linear attack of full round DES

Abstract

In this paper, we derive 7 quadratic relations over GF(2) from the input and output bits of the S-boxes of DES. We apply one of those to an improved linear attack of full round DES. We describe an improved algorithm by combining the non-linear approximation method proposed by Knudsen and Robshaw, and the multiple approximation method proposed by Kaliski and Robshaw. This improvement can reduce the number of required plaintexts and ciphertexts pairs to 25/34 (73.5 %) of those number of pairs 243 required in the linear attack by Matsui.